Published: 18/04/2019 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

The urllib3 library prior to 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

Vulnerable Product	Search on Vulmon	Subscribe to Product
python urllib3
canonical ubuntu linux 16.04
canonical ubuntu linux 18.04
canonical ubuntu linux 18.10
canonical ubuntu linux 19.04

Debian Bug report logs - #927412 python-urllib3: CVE-2019-11324: adds system certificates to ssl_context Package: src:python-urllib3; Maintainer for src:python-urllib3 is Debian Python Modules Team <python-modules-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 19 Apr 20 ...

Several security issues were fixed in urllib3 ...

Synopsis Moderate: python27:27 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for the python27:27 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Sco ...

Synopsis Moderate: python27:27 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for the python27:27 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vul ...

Synopsis Moderate: python-pip security update Type/Severity Security Advisory: Moderate Topic An update for python-pip is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base sco ...

Synopsis Moderate: python-pip security update Type/Severity Security Advisory: Moderate Topic An update for python-pip is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base sco ...

Synopsis Important: Container-native Virtualization security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 240 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Securi ...

Synopsis Moderate: python-urllib3 security update Type/Severity Security Advisory: Moderate Topic An update for python-urllib3 is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) ...

Synopsis Moderate: OpenShift Container Platform 461 image security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat OpenShift Container Platform 46Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability S ...

In the urllib3 library through 1241 for Python, CRLF injection is possible if the attacker controls the request parameter (CVE-2019-11236) The urllib3 library before 1242 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in ...

Impact: Moderate Public Date: 2019-04-17 CWE: CWE-20 Bugzilla: 1702473: CVE-2019-11324 python-urllib3: ...

GitLab 依赖项扫描的咨询数据库，每天17:00自动更新

GitLab Advisory Database This repository contains the security advisories used by the GitLab dependency scanners It can be used for both searching advisories and submitting new ones The GitLab team constantly improves this vulnerability database by checking external sources on a regular basis, and contributing their findings to this repo Learn more on the external sources an

AWS ALB Response Creator The AWS announcement of Application Load Balancers supporting Lambda functions made my reInvent experience! Purpose In doing a PoC however, I found that the statusDescription element was somewhat of an annoyance to code This package provides a method to return the appropriate format of this field without copy/paste response data and allowing a strategy

Security audit Python project dependencies against security advisory databases.

Skjold /skjɔl/ ,- | , ,- | ,-| `- |< | | | | | | Security audit python project dependencies `-' ' ` | `-' `' `-´ against several security advisory databases `' Introduction It currently supports fetching advisories from the following sou

CWE-295 https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4 http://www.openwall.com/lists/oss-security/2019/04/19/1 https://usn.ubuntu.com/3990-1/http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html https://access.redhat.com/errata/RHSA-2019:3335 https://access.redhat.com/errata/RHSA-2019:3590 https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927412 https://nvd.nist.gov https://usn.ubuntu.com/3990-1/

Get Started

CVE-2019-11324

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect